/**
 * Internal escape hatch for tests / key-rotation flows that need to force
 * the next read to re-derive the key from APP_KEY. Not exported from the
 * package barrel on purpose.
 */
export declare function _clearEncryptedKeyCache(): void;
/**
 * Returns true iff `value` is a string that already carries the
 * `enc:` envelope. Used by both the encrypt and decrypt paths to make
 * each idempotent.
 *
 * @example
 * ```ts
 * isEncrypted('enc:AAA:BBB:CCC') // → true
 * isEncrypted('plain string')    // → false
 * ```
 */
export declare function isEncrypted(value: unknown): value is string;
/**
 * Encrypt a value with AES-256-GCM under the app key. Idempotent: an
 * already-prefixed value is returned untouched, so backfill jobs that
 * run twice don't double-encrypt.
 *
 * @example
 * ```ts
 * const ciphertext = await encryptValue('123-45-6789')
 * // → 'enc:<iv>:<tag>:<ciphertext>'
 * ```
 */
export declare function encryptValue(value: unknown): Promise<unknown>;
/**
 * Decrypt an `enc:`-prefixed value. Plaintext (no prefix) passes through
 * unchanged so the trait works against rows written before the column
 * was marked encrypted.
 *
 * Returns `null` on any decrypt failure (after logging) so a corrupted /
 * key-rotated row doesn't bring down the whole read path.
 *
 * @example
 * ```ts
 * const ssn = await decryptValue(row.ssn) // null if undecryptable
 * ```
 */
export declare function decryptValue(value: unknown): Promise<unknown>;
/**
 * Walk a row's attributes, encrypting each key listed in `encryptedKeys`
 * before write. Mutates a shallow copy of the row, not the original — so
 * caller-side debug dumps still see the plaintext value.
 *
 * @example
 * ```ts
 * const safe = await encryptRowForWrite({ name, ssn: '...' }, ['ssn'])
 * await db.insertInto('users').values(safe).execute()
 * ```
 */
export declare function encryptRowForWrite(row: Record<string, unknown>, encryptedKeys: ReadonlyArray<string>): Promise<Record<string, unknown>>;
/**
 * Walk a row's attributes, decrypting each key listed in `encryptedKeys`
 * after read. Mirror of `encryptRowForWrite()`.
 *
 * @example
 * ```ts
 * const row = await db.selectFrom('users').selectAll().executeTakeFirst()
 * const decrypted = await decryptRowForRead(row, ['ssn'])
 * ```
 */
export declare function decryptRowForRead(row: Record<string, unknown>, encryptedKeys: ReadonlyArray<string>): Promise<Record<string, unknown>>;
/**
 * Extract the list of attribute names that have `encrypted: true` from a
 * model definition's `attributes` block. Returns `[]` for models without
 * any encrypted columns so callers don't need to guard.
 *
 * @example
 * ```ts
 * const keys = collectEncryptedAttributes({
 *   attributes: { ssn: { type: 'string', encrypted: true }, name: { type: 'string' } },
 * })
 * // → ['ssn']
 * ```
 */
export declare function collectEncryptedAttributes(definition: { attributes?: Record<string, { encrypted?: boolean } & Record<string, unknown>> }): string[];